-
Elements of use case
- actors
- precondition
- Trigger
- Postcondition
- Normal Flow
- Alternate Flow
-
Confidentiality
- Prevents the unauthorized disclosure of data
- only authorized personnel can access
-
Identification
users claim an identity with a unique username
-
Authentication
users prove their identity with a password
-
Authorization
- grant or restrict access
- for example permissions
-
Steganography
- helps confidentiality
- hides data within a file
-
What is the best way to protect the confidentiality of data?
encrypting
-
access controls
these restrict access helps with confidentiality
-
Integrity
data has not been changed
-
hashing helps with
data integrity
-
What is hashing?
a numeric value created by executing an algorithm against a message or file
-
Digital signature provides
- authentication and integrity usually with emails and files
- non-repudiation- cannot deny it
-
Digital signatures require what two things?
- Use of certificates
- Public Key Infrastructure
-
Disk redundancies
- RAID 1 RAID 5
- allow a system to continue to operate even if a disk fails
-
Server Redundancies
failover clusters include redundant servers and ensure a service will continue even if there server fails
-
What does Load balancing do?
- uses multiple servers to support a website
- it can increase the availability of web sites and web-based application
-
Site Redundancies
if a site can not longer function it can be moved to an alternate site
-
What is the goal of fault tolerance and redundancy?
- eliminate SPOF
- single point of failures
-
Alternate power
backup power generator
-
Cooling systems
keep systems from overheating
-
What is a threat?
anything that has the possibility to compromise confidentiality, integrity, or availibility
-
Most security controls are what kind?
technical, administrative, and physical
-
Encryption, antivirus, IDSs, IPSs, firewalls are all what types of controls?
Technical
-
Motion detectors and fire suppression systems are examples of what type of controls?
Technical physical security/ environment controls
-
Administrative controls
Methods mandated by organizational policies or other guidelines
-
Risk assessment
vulnerability assessment
Penetration tests are all examples of what type of controls?
Administrative controls
-
Risk Assessments
- Help quantify and qualify risks within an organization.
- helps to prioritize what is most important risk
-
Vulnerability Assessments
tries to discover current vulnerabilities or weaknesses
-
Penetration tests
Try to exploit vulnerablities
-
Awareness training
- Administrative controls
- training to maintain password security
- clean desk policy
- understand phishing and malware
-
Configuration management
uses baselines to ensure that systems start in a secure, hardened state
-
Change Management
helps ensure that changes don't result in unintended configuration errors
-
Contingency planning
help organization plan and prepare for potential system outages
-
Lighting, signs, fences, security guards are all examples of what type of controls?
Physical
-
hardening, Security awareness and training, Security guards, Change management, Account Disablement Policy are all examples of what types of controls?
Preventive Controls
-
Hardening
- Makes more secure than basic configuration
- Disabling unnecessary ports and services
- implementing secure protocols, using strong passwords along with a robust password policy, disabling unnecessary accounts
- (preventive)
-
Change management
- admins submit changes to change management who makes sure that the system does not experience any outages
- (preventive)
-
Account Disablement policy
- When employee leaves disable account
- (preventive)
-
Log monitoring, Trend Analysis, Security audit, Video Surveillance, and motion detection are all examples of what type of controls?
Detective
-
Log monitoring
monitor logs to detect incidents
-
Trend Analysis
by analyzing past alerts, you can identify trends to see if they are trying to attack a specific system
-
Security Audit
- Examine the security posture of an organization
- can also detect if users have more rights than they should
-
IPS and Backups and system recovery are what types of control?
Corrective controls
-
IPS
- Intrusion Prevention system
- detects attacks and modifies environment so that attack cannot continue
- (corrective)
-
Cable locks and Hardware locks are what type of controls?
Deterrent
-
Controls used for now but in the mean time developing something else
Compensating controls
-
virtualization
- allows you to host one or more virtual systems, or VMs, on a single physical system
- great to help costs when a company has a lot of unused servers
- also provides a high level of flexibility when testing security controls, updates, and patches because they can easily be reverted using snapshots
-
Type 1 hypervisor
run directly on bare-metal systems without an operating system
-
Type 2 hypervisor
software that run with an operating system
-
Container virtualization
runs within isolated cells or containers and does not have its own kernel
-
Snapshot
provides a copy of VM at a moment in time for a backup
-
VDI/VDE
- Virtualized desktop infrastructure
- for computers with limited hardware resources
-
persistant
virtual desktop each user has a custom desktop
-
non-persistant
virtual desktop reverts back to a known state after use
-
VM escape, VM Sprawl, and Loss of confidentiality are all examples of
Risks associated with Virtualizatin
-
VM escape
- attack that allows an attacker to access the host system from within the virtual system
- attacker runs code on the virtual system and interacts with the hypervisor
-
VM Sprawl
- organization has many VM's that aren't manage properly
- for example leaving a VM running
-
ping
- basic command used to test connectivity for remote systems
- used to verify system can resolve valid host names, test the NIC, and check the security posture of a network
-
windows use ipconfig
linux systems use ifconfig
you can enable promiscuous mode on NIC with ifconfig
ip is similar to ifconfig and can be used to view and manipulate NIC settings
-
netstat
- network statistics
- allows you to view statistics for TCP/IP protocols on a system
-
tracert
lists the routers between two systems
-
arp
- command-line tool that is related to the address resolution protocol
- you can use this to view and manipulate ARP cache
|
|
